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UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF MICHIGAN 
SOUTHERN DIVISION 


UNITED STATES OF AMERICA, 
Plaintiff, 

-vs- 

D-1 CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

D-3 COLTON JURISIC 

D-4 REYAD GAFAR ABBAS 

D-5 GARRETT ENDICOTT 

D-6 RYAN STEVENSON 


Case:2:19-cr-20246 
Judge: Hood, Denise Page 
MJ: Patti, Anthony P. 

Filed: 04-18-2019 At 04:44 PM 
SEALED MATTER (dat) 


Vio: 18U.S.C. § 1349 
18 U.S.C. § 1343 
18 U.S.C. § 1028A(a)(l) 
18 U.S.C. §2 


Defendants. 


/ 


INDICTMENT 


THE GRAND JURY CHARGES: 

GENERAL ALLEGATIONS 

At all times relevant to this Indictment: 

1. “The Community” was a loosely organized group of individuals dedicated to 
online identity theft. A subset of The Community focused on the theft of 
cryptocurrencies such as Bitcoin, LiteCoin, and Ethereum. 
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2. Members of The Community planned and organized their activities on various 
online forums and over diverse channels of communication. Broader 
discussions—such as discussing the manner and means of attacks generally, and 
networking among The Community’s members—typically took place on forums 
such as “OGUsers” and “Hackforums.” Planning and execution of specific 
attacks, as well as victim selection and recruiting, usually took place via 
platforms such as Discord, Skype, Signal, Wickr, and Telegram. 

3. The Community engaged in “SIM Hijacking,” or “SIM Swapping.” This tactic 
enabled The Community to gain control of a victim’s mobile phone number by 
linking that number to a subscriber identity module (“SIM”) card controlled by 
The Community—resulting in the victim’s phone calls and short message service 
(“SMS”) messages being routed to a device controlled by a member of The 
Community. 

4. Once The Community had control of a victim’s phone number, it was leveraged 
as a gateway to gain control of online accounts such as the victim’s email, cloud 
storage, and cryptocurrency exchange accounts. Sometimes this was achieved 
by requesting a password-reset link be sent via SMS to the device controlled by 
The Community. Sometimes passwords were compromised by other means, and 
The Community’s device was used to receive two-factor authentication (“2FA”) 
messages sent via SMS intended for the victim. 
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5. Specific members of The Community endeavored to gain control of a victim’s 
cryptocurrency wallet or online cryptocurrency exchange account and steal the 
victim’s funds. Stolen funds from a successful attack were divided among 
members of The Community that participated in that attack. 

6. During these attacks, one or more members of The Community would 
appropriate the online identity of the victim, using means of identification 
including the victim’s name, email, and mobile phone number. 

7. SIM Hijacking was often facilitated by bribing an employee of a mobile phone 
provider. 

8. Other times, SIM Hijacking was facilitated by “social engineering”: a member of 
The Community would contact a mobile phone provider’s customer service— 
posing as the victim—and request that the victim’s phone number be swapped to 
a SIM card (and thus a mobile device) controlled by The Community. 

9. CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), COLTON 
JURISIC (D-3), REYAD GAFAR ABBAS (D-4), GARRETT ENDICOTT (D- 
5), and RYAN STEVENSON (D-6) were members of The Community 
specializing in the theft of cryptocurrency. 

THE SCHEME TO DEFRAUD AND ITS PURPOSE 

10. Beginning in approximately December of 2017 and continuing through 
approximately May of 2018, CONOR FREEMAN (D-l), RICKY 
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HANDSCHUMACHER (D-2), COLTON JURISIC (D-3), REYAD GAFAR 
ABBAS (D-4), and GARRETT ENDICOTT (D-5), and RYAN STEVENSON 
(D-6) defendants herein, in the Eastern District of Michigan and elsewhere did— 
with the intent to defraud—knowingly participate in a scheme to defraud. The 
goal of this scheme was to obtain cryptocurrency by means of materially false 
and fraudulent pretenses and representations. 

COUNT ONE 

(18 U.S.C. § 1349 - Conspiracy to Commit Wire Fraud) 

D-l CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

D-3 COLTON JURISIC 

D-4 REYAD GAFAR ABBAS 

D-5 GARRETT ENDICOTT 

D-6 RYAN STEVENSON 

11. The allegations of paragraphs 1 through 10 are incorporated herein. 

12. Beginning in approximately December of 2017 and continuing through 
approximately May of 2018, in the Eastern District of Michigan and elsewhere, 
defendants, CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), 
COLTON JURISIC (D-3), REYAD GAFAR ABBAS (D-4), GARRETT 
ENDICOTT (D-5), and RYAN STEVENSON (D-6)—along with others known 
and unknown to the grand jury—did knowingly, intentionally, and willfully 
combine, conspire, confederate and agree to commit wire fraud. They 
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knowingly, willfully, and with the intent to defraud—having devised and 
intending to devise a scheme and artifice to defraud, and to obtain money and 
property by means of materially false and fraudulent pretenses, representations, 
and promises, knowing such pretenses, representations, and promises were false 
and fraudulent when made—transmitted and caused to be transmitted (by means 
of wire communication) writings, signals, pictures, and sounds in interstate and 
foreign commerce for the purposes of executing such scheme and artifice, in 
violation of Title 18, United States Code, Section 1343. 

OBJECT OF THE CONSPIRACY 

13. The object of the conspiracy was the same as the purpose of the scheme to 
defraud set forth in paragraph 10 of this Indictment, which is incorporated by 
reference. 

MANNER AND MEANS OF THE CONSPIRACY 

14. In furtherance of the conspiracy, and to accomplish its object, the methods, 
manner, and means that were used are described in paragraphs 1-9 of this 
Indictment and are incorporated by reference. 

All in violation of Title 18, United States Code, Sections 1349 

COUNT TWO 

(18 U.S.C. §§ 1343 and 2 - Wire Fraud, Aiding and Abetting) 

D-4 REYAD GAFAR ABBAS 
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15. The allegations of paragraphs 1 through 14 are incorporated herein. 

16. On or about February 15, 2018, members of The Community collaborated to 
activate a SIM card and fraudulently link it to the mobile phone number of GP, 
permitting them to pose as GP. 

17. GP’s mobile provider was deceived by social engineering into transferring his 
mobile phone number to a device controlled by The Community. 

18. Using GP’s mobile phone number as a starting point, one or more members of 
The Community proceeded to use GP’s identity to seize control of multiple online 
accounts—including an email address, a DropBox account, a cryptocurrency 
exchange account, and a cryptocurrency wallet. 

19. One or more members of The Community transferred cryptocurrency owned by 
GP, valued at approximately $114,705, to one or more cryptocurrency wallets 
controlled by The Community. 

20. On or about February 15, 2018, REYAD GAFAR ABBAS (D-4) participated in 
in an online chat furthering the scheme to defraud GP that was transmitted in 
interstate commerce—including to and from the Eastern District of Michigan. 

21. REYAD GAFAR ABBAS (D-4) accessed GP’s cryptocurrency exchange 
account and transferred funds stolen from GP. 

22. On or about February 15, 2018, in the Eastern District of Michigan and 
elsewhere, REYAD GAFAR ABBAS (D-4) and other members of The 
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Community did—with the intent to defraud—knowingly participate in a scheme 
to defraud GP by means of false or fraudulent pretenses, representations, or 
promises. 

23. On or about February 15, 2018, in the Eastern District of Michigan and 
elsewhere, REYAD GAFAR ABBAS (D-4) and other members of The 
Community used transmission of writings, signs, signals, and sounds sent in 
interstate commerce in furtherance of the scheme to defraud GP. 

All in violation of Title 18, United States Code, Sections 1343 and 2. 

COUNT THREE 

(18 U.S.C. §§ 1028A(a)(l) and 2 - Aggravated Identity Theft, 

Aiding and Abetting) 

D-4 REYAD GAFAR ABBAS 

24. The allegations of paragraphs 1 through 23 are incorporated herein. 

25. On or about February 15, 2018, in the Eastern District of Michigan and 
elsewhere, REYAD GAFAR ABBAS (D-4) and other members of The 
Community knowingly used identifiers of GP for the purpose of executing the 
above described scheme to fraudulently obtain cryptocurrency during and in 
relation to violation of 18 U.S.C. Sections 1343 and 2. 

All in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2. 
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COUNT FOUR 

(18 U.S.C. §§ 1343 and 2 - Wire Fraud, Aiding and Abetting) 

D-5 GARRETT ENDICOTT 

26. The allegations of paragraphs 1 through 14 are incorporated herein. 

27. On or about March 6,2018, members of The Community collaborated to activate 
a SIM card and fraudulently link it to the mobile phone number of TH, permitting 
them to pose as TH. 

28. Using TH’s mobile phone number as a starting point, one or more members of 
The Community proceeded to use TH’s identity to seize control of multiple 
online accounts—including an email account, a Twitter account, cryptocurrency 
exchange accounts, and a cryptocurrency wallet. 

29. One or more members of The Community transferred cryptocurrency owned by 
TH, valued at approximately $4,929.37, to one or more cryptocurrency wallets 
controlled by The Community. 

30. On or about March 6, 2018, GARRETT ENDICOTT (D-5) participated in an 
online chat and voice call furthering the scheme to defraud TH that was 
transmitted in interstate commerce—including to and from the Eastern District 
of Michigan. 
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31. GARRETT ENDICOTT (D-5)’s role in The Community was to research victims 
and to provide personally identifiable information (PII) associated with victims 
to facilitate the theft of their identities. 

32. On or about March 6, 2018, in the Eastern District of Michigan and elsewhere, 
GARRETT ENDICOTT (D-5) and other members of The Community did—with 
the intent to defraud—knowingly participate in a scheme to defraud TH by means 
of false or fraudulent pretenses, representations, or promises. 

33. On or about March 6, 2018, in the Eastern District of Michigan and elsewhere, 
GARRETT ENDICOTT (D-5) and other members of The Community used 
transmission of writings, signs, signals, and sounds sent in interstate commerce 
in furtherance of the scheme to defraud TH. 

All in violation of Title 18, United States Code, Sections 1343 and 2. 

COUNT FIVE 

(18 U.S.C. §§ 1028A(a)(l) and 2 - Aggravated Identity Theft, 

Aiding and Abetting) 

D-5 GARRETT ENDICOTT 

34. The allegations of paragraphs 1 through 14 and 26 through 33 are incorporated 
herein. 

35. On or about March 6, 2018, in the Eastern District of Michigan and elsewhere, 
GARRETT ENDICOTT (D-4) and other members of The Community, 
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knowingly used identifiers of TH for the purpose of executing the above 
described scheme to fraudulently obtain ciyptocurrency during and in relation to 
violation of 18 U.S.C. Sections 1343 and 2. 

All in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2. 

COUNT SIX 

(18 U.S.C. §§ 1343 and 2 - Wire Fraud, Aiding and Abetting) 

D-1 CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

D-3 COLTON JURISIC 

36. The allegations of paragraphs 1 through 14 are incorporated herein. 

37. On or about May 7, 2018, members of The Community collaborated to activate 
a SIM card and fraudulently link it to the mobile phone number of JP, permitting 
them to pose as JP. 

38. An employee of a mobile phone provider was bribed by JD, a member of The 
Community, to transfer the mobile phone number of JP to a SIM card controlled 
by The Community. 

39. In or about May of 2018, JD paid the bribe via LocalBitcoins.com and PayPal, 
using wire transmissions sent in interstate commerce originating within the 
Eastern District of Michigan. 

40. Using JP’s mobile phone number as a starting point, one or more members of 
the The Community proceeded to use JP’s identity to seize control of multiple 
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online accounts—including an email account, a Twitter account, a 
cryptocurrency exchange account, and a cryptocurrency wallet. 

41. One or more members of The Community transferred cryptocurrency owned by 
JP, valued at approximately $1,669.56, to one or more cryptocurrency wallets 
controlled by The Community. 

42. On or about May 7, 2018, CONOR FREEMAN (D-l) participated in online 
chats furthering the scheme to defraud JP that were transmitted in international 
commerce. 

43. CONOR FREEMAN (D-l) provided one or more members of The Community 
PII of JP that was used to facilitate the attack. 

44. On or about May 7, 2018, RICKY HANDSCHUMACHER (D-2) participated 
in an online chat furthering the scheme to defraud JP that was transmitted in 
international commerce. 

45. RICKY HANDSCHMACHER (D-2) coordinated with JD to further the scheme 
by prompting JD to bribe an employee of a mobile phone provider to swap the 
phone number of JP to a device controlled by the Community. 

46. The coordination between HANDSHUMACHER and JD was done via an 
encrypted messaging application that transmitted signals in interstate 
commerce—including to and from the Eastern District of Michigan—on or about 
May 7, 2018. 
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47. On or about May 5, 2018, COLTON JURISIC (D-3) participated in an online 
chat furthering the scheme to defraud JP that was transmitted in international 
commerce. 

48. COLTON JURISIC (D-3) provided one or more members of The Community 
with PII of JP that was used to facilitate the attack. 

49. In or about May of 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), COLTON 
JURISIC (D-3), and other members of The Community did—with the intent to 
defraud—knowingly participate in a scheme to defraud JP by means of false or 
fraudulent pretenses, representations, or promises. 

50. In or about May of 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), COLTON 
JURISIC (D-3), and other members of The Community did use or cause the use 
of transmission of writings, signs, signals, and sounds sent in international and 
interstate commerce in furtherance of the scheme to defraud JP. 

All in violation of Title 18, United States Code, Sections 1343 and 2. 
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COUNT SEVEN 

(18 U.S.C. §§ 1028A(a)(l) and 2 - Aggravated Identity Theft, 

Aiding and Abetting) 


D-1 CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

D-3 COLTON JURISIC 

51. The allegations of paragraphs 1 through 14 and 36 through 50 are incorporated 
herein. 

52. In or about May of 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), COLTON 
JURISIC (D-3), and other members of The Community knowingly used 
identifiers of JP for the purpose of executing the above described scheme to 
fraudulently obtain cryptocurrency during and in relation to violation of 18 
U.S.C. Sections 1343 and 2. 

All in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2. 

COUNT EIGHT 

(18 U.S.C. §§ 1343 and 2 - Wire Fraud, Aiding and Abetting) 

D-4 REYAD GAFAR ABBAS 

53. The allegations of paragraphs 1 through 14 are incorporated herein. 
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54. On or about May 9, 2018, members of The Community collaborated to activate 
a SIM card and fraudulently link it to the mobile phone number of AL, permitting 
them to pose as AL. 

55. An employee of a mobile phone provider was bribed by JD, a member of The 
Community, to transfer the mobile phone number of AL to a SIM card controlled 
by The Community. 

56. In or about May of 2018, JD paid the bribe via LocalBitcoins.com and PayPal, 
using wire transmissions sent in interstate commerce originating within the 
Eastern District of Michigan. 

57. Using AL’s mobile phone number as a starting point, one or more members of 
The Community proceeded to use AL’s identity to seize control of multiple 
online accounts—including an email account, a Skype account, and a 
cryptocurrency exchange account. 

58. One or more members of The Community transferred cryptocurrency owned by 
AL, valued at approximately $55,493.76, to one or more cryptocurrency wallets 
controlled by The Community. 

59. On or about dates between May 9, 2018 and May 13, 2018, REYAD GAFAR 
ABBAS (D-4) participated in online chats furthering the scheme to defraud AL 
that were transmitted in interstate commerce—including to and from the Eastern 
District of Michigan. 
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60. REYAD GAFAR ABBAS (D-4) accessed AL’s email account to facilitate the 
attack and transferred funds stolen from AL. 

61. In or about May of 2018, in the Eastern District of Michigan and elsewhere, 
REYAD GAFAR ABBAS (D-4) and other members of The Community did— 
with the intent to defraud—knowingly participate in a scheme to defraud AL by 
means of false or fraudulent pretenses, representations, or promises. 

62. In or about May of 2018, in the Eastern District of Michigan and elsewhere, 
REYAD GAFAR ABBAS (D-4) and other members of The Community used or 
caused the use of transmission of writings, signs, signals, and sounds sent in 
interstate commerce in furtherance of the scheme to defraud AL. 

All in violation of Title 18, United States Code, Sections 1343 and 2. 

COUNT NINE 

(18 U.S.C. §§ 1028A(a)(l) and 2 - Aggravated Identity Theft, 

Aiding and Abetting) 

D-4 REYAD GAFAR ABBAS 

63. The allegations of paragraphs 1 through 14 and 53 through 62 are incorporated 
herein. 

64. In or about May of 2018, in the Eastern District of Michigan and elsewhere, 
REYAD GAFAR ABBAS (D-4) and other members of The Community 
knowingly used identifiers of AL for the purpose of executing the above 
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described scheme to fraudulently obtain cryptocurrency during and in relation to 
violation of 18 U.S.C. Section 1343 and 2. 

All in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2. 

COUNTTEN 

(18 U.S.C. §§ 1343 and 2 - Wire Fraud, Aiding and Abetting) 

D-1 CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

D-3 COLTON JURISIC 

65. The allegations of paragraphs 1 through 14 are incorporated herein. 

66. On or about May 15, 2018, members of The Community collaborated to activate 
a SIM card and fraudulently link it to the mobile phone number of DM, 
permitting them to pose as DM. 

67. An employee of a mobile phone provider was bribed by JD, a member of The 
Community, to provide PII of DM that enabled a member of The Community to 
impersonate DM and convince a customer service representative to transfer the 
mobile phone number of DM to a SIM card controlled by The Community. 

68. In or about May of 2018, JD paid the bribe via LocalBitcoins.com and PayPal, 
using wire transmissions sent in interstate commerce originating within the 
Eastern District of Michigan. 

69. Using DM’s mobile phone number as a starting point, members of The 
Community proceeded to use DM’s identity to seize control of multiple online 
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accounts—including an email account, cloud storage accounts, and a 
cryptocurrency wallet. 

70. One or more members of The Community transferred cryptocurrency owned by 
DM, valued at approximately $100,000, to cryptocurrency wallets controlled by 
members of The Community, including CONOR FREEMAN (D-l), RICKY 
HANDSCHUMACHER (D-2) and COLTON JURISIC (D-3). 

71. On or about May 15, 2018, CONOR FREEMAN (D-l), RICKY 
HANDSCHUMACHER (D-2), and COLTON JURISIC (D-3) participated in an 
online chat furthering the scheme to defraud DM that was transmitted in 
international and interstate commerce—including to and from the Eastern 
District of Michigan. 

72. CONOR FREEMAN (D-l) provided one or more members of The Community 
with PII of DM that was used to facilitate the attack. 

73. CONOR FREEMAN (D-l) transferred funds stolen from DM. 

74. COLTON JURISIC (D-3), provided one or more members of The Community 
with PII of DM that was used to facilitate the attack. 

75. On or about May 15, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), COLTON 
JURISIC (D-3), and other members of The Community did—with the intent to 
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defraud—knowingly participate in a scheme to defraud DM by means of false or 
fraudulent pretenses, representations, or promises. 

76. On or about May 15, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), COLTON 
JURISIC (D-3) and other members of The Community did use or cause the use 
of transmission of writings, signs, signals, and sounds sent in international and 
interstate commerce in furtherance of the scheme to defraud DM. 

All in violation of Title 18, United States Code, Sections 1343 and 2. 

COUNT ELEVEN 

(18 U.S.C. §§ 1028A(a)(l) and 2 - Aggravated Identity Theft, 

Aiding and Abetting) 

D-1 CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

D-3 COLTON JURISIC 

77. The allegations of paragraphs 1 through 14 and 65 through 76 are incorporated 
herein. 

78. On or about May 15, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), COLTON 
JURISIC (D-3), and other members of The Community knowingly used 
identifiers of DM for the purpose of executing the above described scheme to 
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fraudulently obtain cryptocurrency during and in relation to violation of 18 
U.S.C. Section 1343 and 2. 

All in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2. 

COUNT TWELVE 

(18 U.S.C. §§ 1343 and 2 - Wire Fraud, Aiding and Abetting) 

D-1 CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

79. The allegations of paragraphs 1 through 14 are incorporated herein. 

80. On or about May 16,2018, members of The Community collaborated to activate 
a SIM card and fraudulently link it to the mobile phone number of SS, permitting 
them to pose as SS. 

81. An employee of a mobile phone provider was bribed by JD, a member of The 
Community, to facilitate the transfer of the mobile phone number of SS to a SIM 
card controlled by The Community. 

82. In or about May of 2018, JD paid the bribe via LocalBitcoins.com and PayPal, 
using wire transmissions sent in interstate commerce originating within the 
Eastern District of Michigan. 

83. Using SS’s mobile phone number as a starting point, members of The 
Community proceeded to use SS’s identity to seize control of multiple online 
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accounts—including an email account, an Evemote account, cryptocurrency 
exchange accounts, and cryptocurrency wallets. 

84. One or more members of The Community transferred cryptocurrency controlled 
and possessed by SS, valued at approximately $1,921,335.80, to one or more 
cryptocurrency wallets controlled by The Community. 

85. On or about May 16, 2018, CONOR FREEMAN (D-l) and RICKY 
HANDSCHUMACHER (D-2) participated in an online chat furthering the 
scheme to defraud SS that was transmitted in international and interstate 
commerce—including to and from the Eastern District of Michigan. 

86. CONOR FREEMAN (D-l) transferred funds that were stolen from SS. 

87. On or about May 16, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), and other 
members of The Community did—with the intent to defraud—knowingly 
participate in a scheme to defraud SS by means of false or fraudulent pretenses, 
representations, or promises. 

88. On or about May 16, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), and other 
members of The Community did use or cause the use of transmission of writings, 
signs, signals, and sounds sent in international and interstate commerce in 
furtherance of the scheme to defraud SS. 


- 20 - 


Case 2:19-cr-20246-DPH-APP ECF No. 1 filed 04/18/19 PagelD.21 Page 21 of 27 


All in violation of Title 18, United States Code, Sections 1343 and 2. 

COUNT THIRTEEN 

(18 U.S.C. §§ 1028A(a)(l) and 2 - Aggravated Identity Theft, 

Aiding and Abetting) 


D-1 CONOR FREEMAN 

D-2 RICKY HANDSCHUMACHER 

89. The allegations of paragraphs 1 through 14 and 79 through 88 are incorporated 
herein. 

90. On or about May 16, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), RICKY HANDSCHUMACHER (D-2), and other 
members of The Community knowingly used identifiers of SS for the purpose of 
executing the above described scheme to fraudulently obtain cryptocurrency 
during and in relation to violation of 18 U.S.C. Section 1343 and 2. 

All in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2. 

COUNT FOURTEEN 

(18 U.S.C. §§ 1343 and 2 - Wire Fraud, Aiding and Abetting) 

D-1 CONOR FREEMAN 

D-3 COLTON JURISIC 

91. The allegations of paragraphs 1 through 14 are incorporated herein. 
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92. On or about May 18, 2018, members of The Community collaborated to activate 
a SIM card and fraudulently link it to the mobile phone number of MT, permitting 
them to pose as MT. 

93. An employee of a mobile phone provider was bribed by JD, a member of The 
Community, to transfer the mobile phone number of MT to a SIM card controlled 
by The Community. 

94. In or about May of 2018, JD paid the bribe via LocalBitcoins.com and PayPal, 
using wire transmissions sent in interstate commerce originating within the 
Eastern District of Michigan. 

95. Using MT’s mobile phone number as a starting point, one or more members of 
The Community proceeded to use MT’s identity to seize control of multiple 
online accounts—including email and cryptocurrency exchange accounts. 

96. One or more members of The Community transferred cryptocurrency owned by 
MT, valued at approximately $164,972.47, to one or more cryptocurrency wallets 
controlled by The Community. 

97. On or about May 18, 2018, CONOR FREEMAN (D-l) and COLTON JURISIC 
(D-3) participated in an online chat furthering the scheme to defraud MT that was 
transmitted in international and interstate commerce—including to and from the 
Eastern District of Michigan. 
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98. CONOR FREEMAN (D-l) accessed MT’s email and cryptocurrency exchange 
accounts, and transferred funds stolen from MT. 

99. COLTON JURISIC (D-3) provided one or more members of The Community 
with PII of MT that was used to facilitate the attack. 

100. On or about May 18, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), COLTON JURISIC (D-3), and other members of 
The Community did—with the intent to defraud—knowingly participate in a 
scheme to defraud MT by means of false or fraudulent pretenses, representations, 
or promises. 

101. On or about May 18, 2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), COLTON JURISIC (D-3), other members of The 
Community did use or cause the use of transmission of writings, signs, signals, 
and sounds sent in international and interstate commerce in furtherance of the 
scheme to defraud MT. 

All in violation of Title 18, United States Code, Section 1343 and 2. 

COUNT FIFTEEN 

(18 U.S.C. §§ 1028A(a)(l) and 2-Aggravated Identity Theft, 

Aiding and Abetting) 

D-1 CONOR FREEMAN 

D-3 COLTON JURISIC 
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102. The allegations of paragraphs 1 through 14 and 91 through 101 are 
incorporated herein. 

103. On or about May 17,2018, in the Eastern District of Michigan and elsewhere, 
CONOR FREEMAN (D-l), COLTON JURISIC (D-3), and other members of 
The Community knowingly used identifiers of MT for the purpose of executing 
the above described scheme to fraudulently obtain cryptocurrency during and in 
relation to violation of 18 U.S.C. Section 1343 and 2. 

All in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2. 

FORFEITURE ALLEGATIONS 

104. Upon conviction of Wire Fraud, in violation of Title 18, United States Code, 
Section 1343, as alleged in Counts 2, 4, 6, 8, 10, 12, and 14, of this Indictment, 
and Conspiracy to Commit Wire Fraud, in violation of Title 18, United States 
Code, Section 1349, defendants shall forfeit to the United States, pursuant to 18 
U.S.C. § 981(a)(1)(C) together with 28 U.S.C. § 2461(c), their right, title and 
interest in any property, real or personal, which constitutes or is derived from 
proceeds traceable to the offenses. 

105. Upon conviction of Aggravated Identity Theft, in violation of Title 18, United 
States Code, Sections 1028(a)(1), as alleged in Counts 3, 5, 7, 9, 11, 13, and 15, 
of this Indictment, defendants shall forfeit to the United States, pursuant to 18 
U.S.C. §§ 982(a)(2)(B) and 1028(b), their right, title, and interest in: (i) any 
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property constituting, or derived from, proceeds the person obtained directly or 
indirectly, as a result of the offense(s), and (ii) any personal property used or 
intended to be used to commit the offense(s). 

106. Forfeiture Money Judgment: Upon conviction of Wire Fraud, in violation of 
Title 18, United States Code, Section 1343, as alleged in Counts 1, 3, 5, 7, 9, 11, 
and 13, of this Indictment, and/or Aggravated Identity Theft, a violation of Title 
18, United States Code, Section 1028(a)(1), as alleged in Counts 2, 4, 6, 8, 10, 
12, and 14, of this Indictment, defendants shall be ordered to pay a sum of money 
equal to the amount of proceeds obtained as a result of their offense(s). 

107. Substitute Assets: Pursuant to Title 21, United States Code, Section 853(p), 
as incorporated by Title 18, United States Code, Section 982(b), Defendants shall 
forfeit substitute property, up to the value of the property subject to forfeiture as 
set forth above, if, by any act or omission of the defendant, property subject to 
forfeiture cannot be located upon the exercise of due diligence; has been 
transferred, sold to or deposited with a third party; has been placed beyond the 
jurisdiction of the court; has been substantially diminished in value; or has been 
commingled with other property which cannot be divided without difficulty. 
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THIS IS A TRUE BILL 

/s/ Grand Jury Foreperson 

GRAND JURY FOREPERSON 

MATTHEW SCHNEIDER 
UNITED STATES ATTORNEY 

/s/ John K. Neal _ 

John K. Neal 

Assistant United States Attorney 
Chief, White Collar Crime Unit 

/s/ Timothy J. Wvse __ 

Timothy J. Wyse 

Assistant United States Attorney 

211 West Fort Street, Suite 2001 

Detroit, MI 48226 

Timothy. Wyse(a)usdoi .gov 

(313)226-9144 

Dated: April 18, 2018 
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ORIGINAL 


United States District Court 

Eastern District of Michigan 

Criminal Case 

Case:2:19-cr-20246 

Judge: Hood, Denise Page 

MJ: Patti, Anthony P. 

Filed: 04-18-2019 At 04:44 PM 

SEALED MATTER (dat) 

NOTE: It is the responsibility of the Assistant U.S. Attorney signing this form t< 

CompanionCase Information 

Companion Case Number: 

This may be a companion case based upon LCrR 57.10 (b)(4) 1 : 

Judge Assigned: 

O Yes G No 

AUSA’s Initials: 


Case Title: USA v. D-1 Conor Freeman, et al. _ 

County where offense occurred : Wayne _ 

Check One: ^ [XjFelony D Misdemeanor GPetty 

_Indictment / ^ Information — no prior complaint. 

_Indictment/_Information — based upon prior complaint [Case number: ] 

_Indictment/_Information — based upon LCrR 57.10 (d) [Complete Superseding section below] 



Superseding to Case No: 


Judge: 


Corrects errors; no additional charges or defendants. 

Involves, for plea purposes, different charges or adds counts. 

Embraces same subject matter but adds the additional defendants or charges below: 

Defendant name Charges Prior Complaint (if applicable) 


Please take notice that the below listed Assistant United States Attorney is the attorney of record for 


the above captioned case. 

April 18, 2019 
Date 


/ 


/ 



/ Timoti^ V J. Wyse 

Assistant United Si 


States Attorney 
211 W. Fort Street, Suite 2001 
Detroit, Ml 48226-3277 
Phone: (313) 226-9144 
Fax: (313)226-2873 
E-Mail address: Timothy.Wyse@usdoj.gov 
Attorney Bar #: 


1 Companion cases are matters in which it appears that (1) substantially similar evidence will be offered at trial, or (2) the same 
or related parties are present, and the cases arise out of the same transaction or occurrence. Cases may be companion cases 
even though one of them may have already been terminated. 
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